Microsoft AZ-104 Exam Dumps, Practice Test Questions

Blob containers store object data accessed through Blob APIs and SDKs. They do not present the managed block device that a VM operating-system disk requires, nor do they become a supported OS disk merely because the application runs on a VM. Use a managed disk attachment and snapshots rather than an arbitrary blob path.

Azure Files SMB shares serve files over a network connection and can support shared-folder workloads, but they are not VM-attachable managed OS disks. An SMB share cannot replace the block-storage device used by the hypervisor for boot and low-level disk I/O. File sharing is useful separately from the VM’s managed-disk requirements.

A storage account access key authorizes calls to supported storage services but does not provision any VM disk capacity, IOPS tier, or attachment. Possession of a key is a security credential, not a block device resource. The workload must create and attach a managed disk resource to obtain the requested storage behavior and snapshot support.

A public DNS CNAME maps one hostname to another endpoint; it does not change how Azure Storage represents objects internally or handles filesystem permissions. Data Lake Gen2 directory semantics cannot be enabled by redirecting clients to the Blob service. The requested POSIX-like hierarchy is a storage account capability, not a DNS naming problem.

Azure Files SMB share permissions govern access to file shares over the SMB protocol and Windows-oriented identity authorization. They do not alter a Blob container’s flat namespace or produce ADLS Gen2 filesystem paths for analytics frameworks. Choosing SMB permissions would address a different service and protocol, leaving the directory semantics request unmet.

Blob versioning keeps historical versions when blobs change; it does not turn flat names or prefixes into hierarchical filesystem directories. ADLS Gen2 POSIX-like directory and ACL semantics require hierarchical namespace on a compatible account. Version history and filesystem namespace answer different requirements.

Storage accounts commonly expose two account keys for rotation. Having one key available rather than two does not create an HTTP-only rejection pattern for identical authentication details. A key change would generally affect both HTTP and HTTPS signatures made with the old value. The scenario’s decisive difference is the transport protocol, not the number of key slots.

Blob versioning records historical versions when objects are modified or deleted and can support recovery of prior data. It is not a request-transport filter. Enabling versioning does not explain why the exact same upload succeeds over HTTPS and fails over HTTP; the account’s secure-transfer policy addresses that contrast directly.

Minimum TLS version controls negotiated TLS sessions; it cannot make a plaintext HTTP upload comply with secure transfer required. The app must use HTTPS because the account now refuses the unencrypted transport.

Secure transfer required ensures the request uses an encrypted HTTPS transport on the applicable Storage service, but it does not eliminate a separate minimum TLS version policy. The application offers only TLS 1.1 while the account requires TLS 1.2 or later. Treating all encrypted connections as acceptable ignores the precise version check causing failure.

A public endpoint changes how clients reach a storage service, not what TLS version the storage account accepts. Even if networking allowed the connection, the storage request using TLS 1.1 would still fail the minimum TLS policy. Exposing a public endpoint to work around this condition adds an unnecessary network surface without updating the outdated client.

Minimum TLS version is configured at the storage account level and applies to supported Azure Storage service requests; it is not an Azure Files-exclusive configuration. The legacy HTTPS client is below the required TLS version regardless of the storage service in this question. Removing the assumption that only Files is affected directs troubleshooting to the actual client protocol.

Under ACL-based Azure Data Lake Storage Gen2 authorization, a permission on the target file is not enough if the caller lacks execute permission on one of its ancestor directories. A nested path must be traversed before the file can be read. The option overlooks that path traversal is checked independently of the file’s read bit.

Read on a directory helps list the names of entries when combined with suitable execute permission, but does not grant traversal on its own. A service identity without execute cannot resolve the route through that ancestor to the target file. Granting directory read alone therefore leaves the precise access-control failure described in the scenario.

An ADLS Gen2 default ACL serves as a template for permissions on child objects created in the future; it does not overwrite the access ACLs on existing directories automatically. Setting a new default ACL after the nested file exists cannot repair the missing execute permission on the current ancestor path. Edit the appropriate access ACL instead.

Azure RBAC Contributor is a management-plane role assigned at Azure resource scopes; a directory default ACL is a different data-plane permission mechanism. Creating a default ACL neither assigns Azure RBAC to analysts nor overrides resource-management authorization. The new children’s behavior points to directory inheritance, not a role grant across the storage account.

The storage account key is a credential granting data access through Shared Key authorization, whereas ADLS Gen2 default ACL entries specify the permissions assigned to newly created filesystem children. The fact that recently created files receive the analyst permissions contradicts the claim that the setting affects only the account key. Existing files require ACL updates of their own.

Recreating all older files would cause needless data movement, reprocessing, and possible loss of metadata or retention context. ADLS Gen2 allows authorized administrators to update the access ACLs on existing files, including recursive operations over a directory tree. The failure is not an immutable storage limitation; it is that default ACLs are applied at child creation time.

Hot and Cool are Blob access tiers used to balance transaction, storage, and retrieval costs for different access patterns. They do not choose independently managed encryption keys for two teams sharing a storage account. Moving data between tiers would affect performance and billing rather than creating the cryptographic separation requested by the teams.

Container separation can help access control, but distinct container names do not automatically select separate encryption keys. Blob encryption scopes are the explicit mechanism for per-dataset encryption treatment.

Blob metadata does not change the key used by Azure Storage server-side encryption. The account must use supported encryption scopes and associate each dataset with the proper scope.

The named group already has read, write and execute in its ACL entry, so additional read is not the missing entitlement. The access mask still removes effective write from that named-group entry. Keeping the mask at r-x continues to deny file creation even when the raw group entry appears permissive to an administrator inspecting it.

A default ACL on the parent is an inheritance template for newly created children, not a retroactive change to an existing directory’s access ACL. The failure occurs when writing a new file into /landing, where the current access mask excludes write. Changing an ancestor default ACL without repairing that access mask leaves the create request denied.

Storage Blob Data Reader provides Blob read access, not permission to create a new file in the ADLS Gen2 directory. It also avoids none of the scenario’s specific ACL-mask diagnosis and unnecessarily changes broader authorization scope. The narrow correction is to grant effective write on the existing directory through its access ACL mask, while keeping the normal group-based boundary.

Changing the deployment scope does not relax the global Azure Storage account naming grammar: letters must be lowercase, the permitted characters are letters and digits, and the name must be unique. A resource-group deployment with the same malformed name still fails name validation; the generator must produce compliant names.

Storage account names contribute to globally unique DNS endpoints and are subject to the same character restrictions in every Azure region. Changing the deployment region cannot legalize an uppercase letter or underscore. Even an otherwise unused name fails before placement because the service validates naming syntax independently of regional capacity.

A virtual-network service endpoint controls which subnets can reach supported Azure service endpoints under configured network rules. It does not modify the storage account naming schema applied during resource creation. Adding the endpoint would leave the uppercase characters and underscore invalid, and it adds networking work unrelated to the provisioning error.

Azure Files SMB exposes a file share to compatible network clients but does not configure the Blob static-website endpoint that an HTTP browser needs. It also does not execute server-side application logic merely because files are stored on it. The scenario asks for static HTTP hosting without servers, so an SMB share addresses the wrong service and protocol.

A service SAS delegates bounded access to a specified Blob or container, but it does not turn on static website hosting or create the special web endpoint. A signed Blob URL can expose data for an authorized request, whereas the website feature publishes index documents from a separate $web container. Authentication URLs and website configuration are different mechanisms.

Hierarchical namespace helps Data Lake Gen2 analytics treat blob paths as directories. It is not the switch that enables storage static website publishing, and some HNS combinations have specific feature-support constraints. Simply turning on hierarchy does not create the $web container, configure an index document, or serve a browser-facing static site.

The spr parameter restricts which transport protocols may be used with the SAS, such as HTTPS-only access. It protects how a download request reaches the service, not what filename the browser receives in Content-Disposition. The partner already downloads successfully; changing transport policy cannot supply the requested response header or override the filename.

The sp field limits which operations the SAS authorizes, including reading or writing the Blob. Granting write permission would widen the partner’s authority and would not instruct a browser to rename a downloaded file. Changing this signed field without producing a valid new signature would also invalidate the URL. Keep read permission and adjust the signed response header instead.

The rsct response override controls the Content-Type header, which tells clients the MIME type of returned data, such as application/pdf. MIME type can affect handling, but it does not set the attachment filename. The scenario asks for Content-Disposition on this signed link, so rscd must be included and signed rather than relying on rsct alone.